Can you make Google forget about you?

This week the European Court of Justice (ECJ) ruled in favour of Google in a significant victory for the tech company. Google argued that the coveted 'right to be forgotten' under EU law should only apply in Europe and not globally when it came to requests to remove personal data from versions of its search engine. The ECJ decided that the operator of a search engine is not required to remove all information it holds about an individual globally. The operator must only get rid of information from the versions of its search engine corresponding to EU Member States.

EU law, including the General Data Protection Regulation or "GDPR", lays down the right of an individual to be forgotten. This means a person can request that an entity holding personal information about them delete that information about them, provided certain conditions are met. GDPR also has extraterritorial effect -- meaning that EU data privacy laws can apply to organisations outside of the EU if they target EU data subjects.

In this particular case, Google had refused an order from the French Data Protection Authority that Google take down (or 'de-reference') from all of its sites search results containing sensitive personal data on a particular person. Google then appealed to the French Council of State who referred the matter to the ECJ. The ECJ concluded that there is no obligation under EU law for a search engine operator who grants a de-referencing request to carry out the de-referencing on all versions of its search engine. However, it must carry out de-referencing on all versions that correspond to EU Member States (e.g. the ".fr" or ".de" pages) .

Some commentators have 'yahoo'd' the decision. Those in favour (such as the Article 19 Foundation) view this as a win for freedom of expression and access to information - - as it shows that data regulators within the EU are prepared not to impose certain of their laws and determine search results of those outside of the EU.

Others are concerned that the effect of the decision will be avoided -- for example by using a virtual private network (VPN) from within Europe.

Opposing views aside, this is an important decision from a New Zealand point of view, as it shows the EU courts' appetite not to apply EU law in a blanket way across the globe. In reading the ECJ press release it appears that the principles of privacy and sovereignty of other nations informed the ECJ's decision.

‍

Data protection rights is not an absolute right, but must be considered in relation to its function in society